Documentation
¶
Overview ¶
Package kms implements crypto.KMSClient on top of the AWS KMS SDK.
It is separate from pkg/crypto so that the encryption primitives — AES-GCM, HKDF, Argon2, BIP39 — and the crypto.KMSClient interface they are described in carry no cloud SDK. Importing pkg/crypto costs nothing; importing this package pulls the AWS SDK, and only a caller that actually uses KMS envelope encryption pays for it (RFC 0022 §6).
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type API ¶
type API interface {
Encrypt(ctx context.Context, params *awskms.EncryptInput, optFns ...func(*awskms.Options)) (*awskms.EncryptOutput, error)
Decrypt(ctx context.Context, params *awskms.DecryptInput, optFns ...func(*awskms.Options)) (*awskms.DecryptOutput, error)
}
API defines the subset of the AWS KMS SDK client required by Client.
type Client ¶
type Client struct {
// contains filtered or unexported fields
}
Client wraps the AWS KMS SDK v2 client and implements crypto.KMSClient.
type Option ¶
type Option func(*clientConfig)
Option configures a KMS client.
func WithConfig ¶
WithConfig sets the full AWS config for KMS.
func WithEndpoint ¶
WithEndpoint sets a custom base URL for KMS (e.g. for MinIO or localstack).
Source Files